Cybersecurity information flow

An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. Here, the /aom/html/EditTemplate.jsf and /aom/html/ViewAllTemplatesPage.jsf templateName parameter is used.

一款功能强大的文件敏感信息搜索工具。

Microsoft Edge 114.0.1823.67 (64-bit) - Information Disclosure

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution.
[GitHub]Fuel CMS 1.4.1 - Remote Code Execution - Python 3.x

A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface inadequately validates user input. An attacker could exploit this vulnerability by authenticating to the application as a low-privileged user and sending crafted SQL queries to an affected system. A successful exploit could allow the attacker to read sensitive data on the underlying database.
[GitHub]PoC script for CVE-2023-20110 - Cisco Smart Software Manager On-Prem SQL Injection Vulnerability

攻击者使用恶意文件冒充乌克兰世界大会组织安装恶意软件，包括MagicSpell加载程序和RomCom后门。

Asanhamayesh CMS version 3.4.6 suffers from a directory traversal vulnerability.

Nedal CMS version 1.2 suffers from a remote SQL injection vulnerability.

影响厂商:HackerOne 奖励: 危险等级:medium

Modified DomainPasswordSpray version to enumerate machine accounts and perform a pre2k password spray.

An updated version of keystroke logger targeting the Remote Desktop Protocol (RDP) related processes, It utilizes a low-level keyboard input hook, …

Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.
[GitHub]Proof of concept for CVE-2022-23614 (command injection in Twig)

被盗取的学生信息包括照片、姓名、学号、籍贯等，这些信息被公开在网站上。

This Metasploit module exploits an SQL injection vulnerability in the MOVEit Transfer web application that allows an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker can leverage an information leak be able to upload a .NET deserialization payload.

美国国家安全部（NSD）成立了一个新的网络部门，旨在能够更有力地应对高技术性的网络威胁。 这个新成立的部门，正式名称为国家网络安全科，是为了响应美国司法部 （DoJ） 2022 年全面网络审查中的核心调查结果而创建的。 该审查的任务是评估司法部的诉讼和调查能力，包括进攻和防御，以及司法部与其他联邦、州和地方执法机构以及私营部门的合作情况。 美国国家安全事务的助理司法部长马修 · 奥尔森（Matthew G. Olsen）表示：这个新部门将协助国家安全局提高打击网络攻击活动的规模和速度，并对民族、国家威胁者、国家支持的网络组织、相关的洗钱者以及其他由网络引起的对国家安全的威胁进行起诉。 奥尔森说，国家网络安全科不仅有助于加强与刑事部计算机犯罪和知识产权科（CCIPS）以及联邦调查局的合作，它还将成为全国94个美国检察官办公室和56个联邦调查局外地办事处的宝贵资源。 根据司法部的说法，新部门的定位是快速响应，一旦联邦调查局或IC合作伙伴发现网络威胁，他们将从最早的阶段进行支持调查和打击工作。 在公告中，奥尔森还谈到了司法部最近的政绩，即在5月份成功打击了俄罗斯犯罪分子对美国的两次重大网络活动。 最近一次是对一名俄罗斯国民因涉嫌参与LockBit和Hive勒索软件攻击的指控，其中包含对美国的关键基础设施，包括医院、学校、非营利组织和执法机构进行攻击。 据称，这位名叫米哈伊尔-马特维耶夫（Mikhail Matveev）的嫌疑人参与了超过65次针对1400个受害组织的网络攻击，在全球范围内收取超过2亿美元的赎金。逮捕他的悬赏金为1000万美元。 第二个案件涉及打掉一个复杂的俄罗斯间谍黑客网络，被称为Snake恶意软件网络，联邦调查局已经跟踪了近二十年。 据说，俄罗斯的间谍行动负责从至少50个国家的数百个计算机系统中窃取成千上万的敏感文件。 奥尔森说，网络安全事关国家安全，网络犯罪分子进攻手段不断进化，不断调整他们的战术，以渗透到我们的网络中并规避检测。 国家安全局致力于通过调整我们的战术和人员来应对我们的对手，将我们所有的工具、专业知识和网络安全人才带到这场战斗中。 司法部预计，国会正式批准的国家网络安全科将与国家安全部的反恐、反间谍科及出口管制科处于同一级别。     转自 Freebuf，原文链接：https://www.freebuf.com/news/370017.html 封面来源于网络，如

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
[GitHub]POC Exploit to add user to Sudo for CVE-2022-0847 Dirty Pipe Vulnerability

WinDiff 是一个开源的基于 Web 的工具，允许跨不同版本的操作系统浏览和比较 Microsoft Windows 二进制文件的符号和类型信息。二进制数据库会自动更新以包含来自最新 Windows 更新的信息

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.
[GitHub]CSV File Containing CVE-2023-34362 IOCs

In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519
[GitHub]CVE-2023-20963 PoC (Android WorkSource parcel/unparcel logic mismatch)

零、前言 学习Java代码审计，这是反序列化部分的第一篇，由于Java语言的特性的，感觉整体要比之前学的Pyt […]

零、前言 Fastjson是由alibaba开源的一款第三方库，可以实现Json和Java Object的相互 […]

Proof of concept exploit for a type confusion bug in the JIT compiler of Chrome that can be used to achieve remote code execution.

QuadraInspect整合了AndroPass、APKUtil和MobFS（RMS）工具，并提供了非常强大的Android应用程序安全分...

Bearer可以帮助广大研究人员发现并过滤目标应用代码中存在的安全问题和隐私风险，并确定安全问题的优先级。

作者：纳兰性德
谁念西风独自凉，萧萧黄叶闭疏窗，沉思往事立残阳。
被酒莫惊春睡重，赌书消得泼茶香，当时只道是寻常。

作者：马致远
枯藤老树昏鸦，小桥流水人家，古道西风瘦马。夕阳西下，断肠人在天涯。

意大利工业部表示，其网站和应用程序在当地时间5月26日周五清晨遭受“严重网络攻击”后出现故障。